Read the docs
TI-2025-04042 Aliases CVE-2025-4527GHSA-2h27-gcg3-7h2g

Dígitro NGC Explorer Password Transmission client-side enforcement of server-side security

Priority LOW 29CWE-602Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security flaw has been discovered in Dígitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission Handler. Performing a manipulation results in client-side enforcement of server-side security. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. Upgrading to version 3.48.22 is sufficient to resolve this issue. Upgrading the affected component is recommended. The action taken by the vendor is: "Strengthening of security validation performed on the server side, together with improvements to administrative and authentication controls." The vulnerabilities are limited to NGC Explorer and do not affect other Dígitro products, including UNA and Guardião.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00613 49th percentileScored 2026-11-07
Fix Fixed NGC Explorer (Dígitro): 3.48.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DígitroNGC Explorer3.48.0; 3.48.1; 3.48.2; 3.48.3; 3.48.4; 3.48.5; 3.48.6; 3.48.7; 3.48.8; 3.48.9; 3.48.10; 3.48.11; 3.48.12; 3.48.13; 3.48.14; 3.48.15; 3.48.16; 3.48.17; 3.48.18; 3.48.19; 3.48.20; 3.48.213.48.22Patch availableCNA
  • NGC Explorer VendorDígitro Affected 3.48.0; 3.48.1; 3.48.2; 3.48.3; 3.48.4; 3.48.5; 3.48.6; 3.48.7; 3.48.8; 3.48.9; 3.48.10; 3.48.11; 3.48.12; 3.48.13; 3.48.14; 3.48.15; 3.48.16; 3.48.17; 3.48.18; 3.48.19; 3.48.20; 3.48.21 Fixed in 3.48.22 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:digitro:ngc_explorer:3.44.15:*:*:*:*:*:*:*3.44.15VulnerableDígitro
  • cpe:2.3:a:digitro:ngc_explorer:3.44.15:*:*:*:*:*:*:* Versions 3.44.15 Vulnerable ·Dígitro

Remediation

  • Fix · CNA NGC Explorer (Dígitro) Fixed in 3.48.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4527
  2. 2026-10-03 Alias added: GHSA-2h27-gcg3-7h2g

References

Patch 1

Other 2

  • TI-2025-04043 Dígitro NGC Explorer session expiration CVSS 4.0MEDIUM 5.3
  • TI-2025-04041 Dígitro NGC Explorer Configuration missing password field masking CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences